xql_get_query_results
Retrieve results of an executed XQL query from Cortex XSIAM. Control response size and choose blocking or non-blocking retrieval.
Instructions
Get XQL query results
Retrieve results of an executed XQL query API.
Note: This endpoint only works on XQL queries initiated by /public_api/v1/xql/start_xql_query/.
Maximum result set size is 1000. The API does not support pagination, therefore, you can set values to determine the result size limitation and how to wait for the results. To view response with greater than 1000 results you must call Get XQL query results Stream.
For more information on how to run XQL queries, see Running XQL query APIs.
Note
To ensure you don't surpass your quota, Cortex XSIAM allows you to run up to four API queries in parallel.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/xql/get_query_results] · XQL query
Example request body:
{
"request_data": {
"query_id": "061880b4867446_4356_inv",
"pending_flag": true,
"limit": 100,
"format": "json"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | Yes |